A vulnerability in the OpenWrt attended sysupgrade server [LWN.net]

The OpenWrt project has issued an advisory regarding a vulnerability found in its Attended Sysupgrade Server that could allow compromised packages to be installed on a router by an attacker. No official OpenWrt images were affected, and the vulnerability is not known to be exploited, but users who have installed images created with an instance of this server are recommended to reinstall.

For a detailed description of how the exploit works, see this blog post.

Then, as the hash collision occurred, the server returns the overwritten build artifact to the legitimate request that requests the following packages. [...]
By abusing this, an attacker could force the user to upgrade to the malicious firmware, which could lead to the compromise of the device.

The LWN site is currently under high scraper load, so comment display has been suppressed for anonymous users. If you are a human, you may read the comments by clicking the button below:

Note: you can avoid this step in the future by logging into your LWN account.